NDPR considerations for Nigerian schools using School Vault

Your school is the data controller

Under the NDPR (Nigeria Data Protection Regulation 2019) and its successor NDPA (Nigeria Data Protection Act 2023), your school is the data controller, you determine the purpose and means of processing personal data about your students, staff, and parents. School Vault is the data processor, processing data on your behalf, under your instructions.

This means compliance is your school's responsibility. School Vault provides the tools to make compliance achievable; using those tools correctly is down to you.

Lawful basis for processing child data

Before processing any personal data, you must have a lawful basis. For school data, the most applicable bases are:

• Contractual necessity, processing needed to fulfil the school's contract with the child's family (attendance records, academic records, fees)
• Legitimate interests, processing reasonably necessary for the school's operations (internal communications, timetabling, HR records)
• Consent, for processing that goes beyond contractual or operational necessity (e.g. publishing a child's photo on the school website, sharing records with a third party)

Parental consent and what to obtain it for

School Vault's parent invitation flow obtains agreement to the platform's terms of service. This covers the basics of using the system. However, you should additionally obtain explicit consent from parents for:

• Photography, taking and storing photos of children, sharing with other parents or on social media
• Sharing records with third parties, e.g. health visitors, CAMHS referrals, safeguarding agencies
• Marketing communications, newsletters, event invitations sent via the messaging system

Consent should be documented. Store signed consent forms in the student's profile under Documents.

Data minimisation

Only collect and store data that is necessary for the stated purpose. Practical implications:

• Do not record medical details that are not relevant to the child's care in school (e.g. a parent's medical condition is not necessary).
• Do not upload copies of passports or birth certificates unless specifically required (e.g. for a school that processes visas). Use admission numbers instead of national ID numbers where possible.
• Do not keep data longer than necessary. Archive withdrawn students after 3 years; delete after 7 years unless there is a legal obligation to retain longer.

Subject access requests

Under NDPR, individuals (or parents on behalf of minors) can request a copy of all personal data held about them. If you receive a subject access request:

1. Verify the requester's identity.
2. Export the relevant records from School Vault: student profile, attendance history, health records, academic records, financial records, message logs.
3. Respond within 30 days.
4. You can export most data from the individual student's profile. For a complete data package, contact support@schoolvault.ng and we can provide a structured export.

Breach notification obligations

If a personal data breach occurs (unauthorised access, accidental disclosure, data loss), NDPR requires notification to the National Information Technology Development Agency (NITDA) within 72 hours of becoming aware of the breach, and to affected individuals without undue delay.

If you suspect a breach involving School Vault data:

1. Contact support@schoolvault.ng immediately. We will investigate and confirm whether data was affected.
2. Document what happened, when you became aware, and what data may have been involved.
3. Report to NITDA at nitda.gov.ng if personal data was affected.
4. Notify affected parents and staff members.

What School Vault does not do on your behalf

• School Vault does not obtain parental consent for you, your admissions and enrolment process must include this.
• School Vault does not manage subject access requests, you are responsible for collating and responding to these.
• School Vault does not file breach reports with NITDA, you must do this as the data controller.

Common mistakes

• Assuming that using School Vault makes the school NDPR-compliant, it provides compliant infrastructure, but your procedures (consent collection, DPO appointment, breach response) must also be in place.
• Storing sensitive data in free-text fields without a lawful basis, e.g. entering "Father in prison" in a student's notes field. Only record information that is relevant and necessary for the child's care.